Tuesday, May 6, 2025
HomeComputer SecurityFake Flash Updates pushing Malware to Inject XMRig Cryptocurrency Miners

Fake Flash Updates pushing Malware to Inject XMRig Cryptocurrency Miners

Published on

SIEM as a Service

Follow Us on Google News

Newly discovered fake flash updates malware pushing XMRing Cryptocurrency miners along with borrowing the original Adobe installer flash updater notification.

Recent campaigns are pushing various malware via fake Flash updates that drop and install cryptocurrency miners and other threats such as information stealers, or ransomware.

In this campaign not only install the crypto mining malware but also update a victim’s Flash Player to the latest version.

- Advertisement - Google News

This legitimate Flash update helps to trick victims who may not notice any unwanted behavior and crypto miners or other injected malware silently running in the background of the compromised victim’s computer.

  • According to Palo Alto researchers, While searching for these particular fake Flash updates, we noticed Windows executables file names starting with AdobeFlashPlayer__ from non-Adobe, cloud-based web servers.
  • These downloads always contained the string flashplayer_down.php?clickid= in the URL. We found 113 examples of malware meeting these criteria since March 2018 in AutoFocus. 77 of these malware samples are identified with a CoinMiner tag in AutoFocus. 

Fake Flash Updates Infection Process

The initial stage of potential URL arriving at the victim’s machine and how URLs delivering fake Flash updates was unclear but tested sample generated Adobe Flash installer popup windows.

Once vicitms click the popup windows then it will process the Flash Player installation and the crypto miners will start and work in the background of the infected windows machine.

Later Potential victims will receive warnings about running such downloaded files on their Windows computer and also it warned that about an unknown publisher.

Once victims click “Yes” it downloads an actual Flash Player from Adobe and install the real Flash Player.

Later it asks users about the flash updates in order to install the downloaded updates right now or notify me later.

Researcher captures the download and installation traffic and it consisted mainly of the Flash update meanwhile his infected lab host soon generated traffic associated with XMRig cryptocurrency mining over TCP port 14444.

“Attackers using Monero wallet for this miner and once it begins the traffic Windows host generated an HTTP POST request to osdsoft[.]com. This domain is associated with updaters or installers pushing cryptocurrency miners and other unwanted software”, Researcher said.

Also Read:

Hackers Abusing Legitimate Googlebot Services to Inject Cryptomining Malware

Roaming Mantis Hacking Group Inject Web Crypto Mining for iOS Devices via Malicious Content Delivery System

Beware !! USB Devices & Removable Media are Used to Inject Cryptocurrency Mining Malware

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...